Bulk Email Domain Audit: SPF, DKIM, DMARC, MX, BIMI, MTA-STS

Check deliverability authentication for thousands of domains, with no login, no browser and no code. Export to JSON, CSV or Excel, or use the API.

Paste a list of domains (or email addresses) and get a deliverability authentication report card for each: score, A–F grade, and a plain-English fix list. It checks what Gmail, Yahoo and Microsoft require from senders:

• SPF: missing or duplicate records, +all/?all, and the 10-DNS-lookup limit counted through every nested include, the most common hidden cause of SPF permerror.
• DMARC: present, policy (none/quarantine/reject), pct, reporting (rua), alignment.
• DKIM: probes 60+ common selectors (Google, Microsoft 365, SendGrid, Mailchimp, Klaviyo, HubSpot, Amazon SES, Zoho, Hostinger, Resend…), reports key size, and flags 1024-bit keys and revoked or wildcard keys.
• MX / mail provider (Google Workspace, Microsoft 365, Proofpoint, Mimecast, Zoho, and more) plus sending platforms inferred from SPF.
• BIMI, MTA-STS, TLS-RPT, and a single bulkSenderReady flag.
• Monitor mode: schedule it and get alerted when any domain's SPF, DMARC, DKIM, MX or grade changes.

Who it's for

• Cold-email and outbound teams: audit every sending domain and inbox-rotation domain before warming it.
• Agencies and MSPs: one report across all client domains, re-run weekly to catch breakage.
• Lead-gen / sales intel: segment prospects by mail provider (Google vs Microsoft vs gateway like Proofpoint) and email maturity.
• Security teams: watch for DMARC downgrades or SPF changes on your own brands.

Input

{"domains":["acme.com","jane@globex.com"],"extraDkimSelectors":["mycustom2024"],"monitorMode":false}

Output (trimmed)

{"domain":"therealtour360.com","grade":"B","score":87,"mailProvider":"Hostinger","bulkSenderReady":true,
 "spf":{"record":"v=spf1 include:_spf.mail.hostinger.com ~all","all":"softfail","lookups":3},
 "dmarc":{"policy":"none","rua":null},"dkim":{"found":[{"selector":"hostingermail-a","approxKeyBits":2048}]},
 "issues":[{"severity":"medium","code":"DMARC_P_NONE","message":"DMARC is monitor-only (p=none)..."},
           {"severity":"low","code":"DMARC_NO_RUA","message":"No rua= reporting address..."}]}

How it works and limits

• Public DNS only (DNS-over-HTTPS via Cloudflare with Google as fallback). It never connects to mail servers, sends email, or checks mailboxes, so it's safe to run on any domain.
• DKIM: DNS can't list selectors, so a domain that signs with a custom selector shows DKIM_NOT_FOUND. Add the selector from a real email header (DKIM-Signature: s=...) via extraDkimSelectors. Big senders (e.g. google.com) rotate dated selectors and will show this.
• Key size is estimated from the public key length (±, good enough to spot 1024-bit keys).
• No blocklist (DNSBL) checks: the major lists forbid commercial use through public resolvers.

Example output

{
  "domain": "google.com",
  "exists": true,
  "score": 97,
  "grade": "A",
  "mailProvider": "Google Workspace",
  "mx": [
    "10 smtp.google.com"
  ],
  "nullMx": false,
  "spf": {
    "record": "v=spf1 include:_spf.google.com ~all",
    "count": 1,
    "all": "softfail",
    "lookups": 1,
    "senders": [
      "Google Workspace"
    ]
  },
  "dmarc": {
    "record": "v=DMARC1; p=reject; rua=mailto:mailauth-reports@google.com",
    "policy": "reject",
    "subdomainPolicy": null,
    "pct": null,
    "rua": "mailto:mailauth-reports@google.com",
    "ruf": null,
    "adkim": "r",
    "aspf": "r"
  },
  "dkim": {
    "selectorsChecked": 55,
    "found": [],
    "revokedSelectors": [],
    "wildcardRecord": false
  },
  "bimi": null,
  "mtaSts": "v=STSv1; id=20210803T010101;",
  "tlsRpt": "v=TLSRPTv1;rua=mailto:sts-reports@google.com",
  "sendingPlatforms": [
    "Google Workspace"
  ],
  "issueCount": 1,
  "issues": [
    {
      "severity": "medium",
      "code": "DKIM_NOT_FOUND",
      "message": "No DKIM key at 55 common selectors. (Your provider may use a custom selector; add it in \"extraSelectors\".)"
    }
  ],
  "bulkSenderReady": false,
  "error": null
}

Pricing

Pay per result, with no monthly rental or subscription:

• Domain audited: $0.003
• Domain DNS changed (monitor): $0.01

Example: 1,000 results cost about $3.00 in fees. Apify's free plan includes $5 of monthly credit, which is enough to test this Actor.

FAQ

Do I need an account, cookies or a login for the source site? No. Bulk SPF, DKIM & DMARC Domain Audit uses public data sources only, so there is nothing to connect and no account to risk.

How much will a run cost? You pay only for results delivered (see Pricing above), plus Apify platform usage, which the free plan's monthly credit easily covers for test runs. Start with a small limit to see the exact cost per run.

Can I export to CSV, Excel or Google Sheets? Yes. Every run's dataset can be downloaded as JSON, CSV, Excel, XML or HTML, or pushed to Google Sheets, Make, Zapier, n8n, Slack or a webhook through Apify integrations.

Can I run it on a schedule or from my own code? Yes. Add an Apify Schedule (hourly, daily, weekly) or call it through the Apify API / Python & JavaScript clients. It also works with AI agents through the Apify MCP server.

What happens if an input is invalid or a source is down? The run keeps going. The bad input gets a row with an error field so you can see what failed, and you are not charged for results that were not delivered.

Is this legal to use? It collects publicly available data. You are responsible for using the output in line with the source's terms and privacy laws such as GDPR/CCPA; don't use it for spam.

Something missing or broken? Open an issue on the Issues tab. Feature requests are usually added within a few days.

Related tools

• Bulk Email Validator: Syntax, MX, Disposable & Role Check
• Bulk DNS Lookup & DNS Change Monitor
• Website Contact Details Extractor: Emails, Phones & Socials
• Bulk HTTP Security Headers Checker & Grade (with change alerts)
• Bulk Domain WHOIS (RDAP) Lookup: Age, Expiry, Registrar & DNS

REST API

GET https://api.mediaprotools.com/v1/email-auth?items=... (header X-API-Key). Up to 10 items per call, separated by ,. Or POST {"items":[...],"options":{...}}.

Parameter	Type	Notes
items	token	Domains (acme.com) or emails (jane@acme.com, where only the domain part is used). Duplicates are removed.
extraDkimSelectors	array	Custom selectors to test on top of the 60+ built-in common ones (find yours in an email header: DKIM-Signature s=...).

Output fields: bimi, bulkSenderReady, checkedAt, dkim, dmarc, domain, error, exists, grade, issueCount, issues, mailProvider, mtaSts, mx, nullMx, score, sendingPlatforms, spf, tlsRpt.